Medium WID-SEC-2025-2235 1 CVE

Elasticsearch: Schwachstelle ermöglicht Offenlegung von Informationen

Published Jan 1, 2019 · Updated Oct 8, 2025 · Revision 2 · de-DE

Vendor: Juniper Networks Product: Junos Space Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Elasticsearch ausnutzen, um Informationen offenzulegen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 1

Medium 5.9

CVE-2018-17247

Improper Restriction of XML External Entity Reference in Elasticsearch

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially cra…

Elastic Elasticsearch org.elasticsearch:elasticsearch Maven

Dec 20, 2018

Revision history

2025-10-08 #2
Neue Updates von Juniper aufgenommen
2019-01-01 #1
Initial Release

References

National Vulnerability Database vom 2019-01-01
https://nvd.nist.gov/vuln/detail/CVE-2018-17247
Juniper Security Advisory JSA103138 vom 2024-10-08
https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Security-Director-Multiple-vulnerabilities-resolved-in-24-1R4-by-upgrading-Log4j-Java-library-to-2-23-1-and-ElasticSearch-to-6-8-17